Local Privilege Escalation Vulnerability in Netskope Client for macOS
CVE-2021-41388

7.8HIGH

Key Information:

Vendor

Netskope

Status
Netskope
Vendor
CVE Published:
4 January 2022

What is CVE-2021-41388?

The Netskope client for macOS versions prior to 89.x is susceptible to a local privilege escalation issue due to inadequate validation on new connections within the XPC implementation of the nsAuxiliarySvc process. This oversight allows low-privileged users to establish connections and invoke external methods defined in the XPC service, potentially granting them elevated privileges as the root user. This vulnerability exposes systems to significant security risks, highlighting the importance of timely updates and thorough security practices.

References

https://www.netskope.com/company/security-compliance-and-...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.